| coolbhavi | dpm, \hey | 06:32 |
|---|---|---|
| coolbhavi | good morning :) | 06:32 |
| dpm | hey coolbhavi, good morning :) | 06:32 |
| coolbhavi | dpm, I'm just about to finish feedback on the draft | 06:33 |
| dpm | coolbhavi, oh, that's really awesome, thanks! | 06:33 |
| dpm | coolbhavi, if you've got any questions apart from the feedback, or if anything is unclear in the spec, please let me know and I'll be happy to answer | 06:34 |
| coolbhavi | dpm, I wrote it in the feedback only sorry for that | 06:35 |
| coolbhavi | I do have | 06:36 |
| dpm | coolbhavi, no need to be sorry for anything, I can answer the questions in any way you like :) | 06:36 |
| coolbhavi | dpm, most part looks fine thanks for the wonderful work you are doing.. but can we have a rejection mechanism if an app submitted does not comply ton the standards instead of a damage control mechanism like for instance revoking access? | 06:40 |
| ajmitch | hi | 06:41 |
| dpm | coolbhavi, actually, dholbach was mentioning something along these lines the other day: uploading an empty app to replace a "bad" app. Do you think that'd be enough, or do you have any ideas for an app rejection mechanism? | 06:42 |
| dpm | hey ajmitch :) | 06:42 |
| coolbhavi | ajmitch, hey :) | 06:43 |
| coolbhavi | dpm, yes I think we can integrate some code in Myapps like if the apps doesnt pass through "x" check which is mandatory it doesnt allow you to upload with an error message | 06:45 |
| coolbhavi | much like what LP works in the case of a package upload | 06:46 |
| coolbhavi | if any universe contributor tried to upload into universe or main repo it doesnt accept and no access mail comes | 06:47 |
| dpm | coolbhavi, ah, gotcha now. Actually, that's already the idea: if the app doesn't pass the automated checks (we're thinking of using Lintian with a new profile we define), you won't be able to upload. Have a look at the design mockups here: https://wiki.ubuntu.com/AppDevUploadProcess#App_Review - that makes me think we should probably add a paragraph on the spec to make it clearer, though | 06:48 |
| ajmitch | dpm: uploading an empty app is due to how apt works, when you really need to replace something broken | 06:48 |
| ajmitch | if I get this computer working I'll try & add some feedback tonight :) | 06:49 |
| dpm | ajmitch, that'd be great, thanks! :) | 06:49 |
| dpm | ajmitch, re: app uploads, yeah, I think we were talking about two different things, though. Now I understand Bhavani meant stopping an app to get into the process rather than removing an existing app | 06:50 |
| ajmitch | right | 06:50 |
| coolbhavi | replacing with an empty app is also a good idea but on the flip side extras.ubuntu.com syncs on from PPA every 1 hour and you need to explicitly stop syncing for that particular app I guess | 06:50 |
| ajmitch | aiui, an app will have to pass all automated checks prior to being published, and sometimes some manual checks | 06:50 |
| coolbhavi | dpm, ah got it in mockups thanks :) | 06:51 |
| coolbhavi | ajmitch, +1 | 06:51 |
| ajmitch | hopefully as few manual checks as possible | 06:51 |
| coolbhavi | agreed | 06:52 |
| ajmitch | my main doubts are with the sandboxing & construction of apparmor profiles | 06:53 |
| ajmitch | perhaps I'd have to try & write some deliberately malicious apps to exercise some corner cases :) | 06:54 |
| dpm | ajmitch, we're intentionally reducing and removing manual checking in the measure possible, as human review is the main bottleneck in such processes. I think we should identify any manual checks still required and think of ways they can be automated | 06:54 |
| ajmitch | dpm: right | 06:54 |
| coolbhavi | ajmitch, :) so that permissions are stricter with app armor profiles | 06:56 |
| ajmitch | permissions are more fine-grained | 06:56 |
| ajmitch | and you can have permissions on more than just files, as the spec shows | 06:56 |
| coolbhavi | yep got it :) | 06:57 |
| ajmitch | problem is that many app authors won't have written apps with this in mind, I saw a section added to the spec today about having to deal with permission denials | 06:57 |
| ajmitch | dpm: I don't have the spec open, is there a way for users to revoke access to certain things without just uninstalling an app? | 06:58 |
| coolbhavi | dpm, ajmitch I thought the ARB revokes the access | 07:00 |
| ajmitch | coolbhavi: it's getting a bit out of scope, but I mean things like a user not wanting to allow an app access to ~/Pictures | 07:01 |
| ajmitch | it's more in the scope of a apparmor profile control UI | 07:02 |
| dpm | coolbhavi, he's referring to the user revoking security permissions for an app they've got installed | 07:02 |
| coolbhavi | ah ok sorry for that | 07:02 |
| ajmitch | what dpm said :) | 07:03 |
| dpm | ajmitch, currently we're not catering for that. The security policy controls are thought to affect all apps, and not be modifiable on a single app basis. The only thing that applies to single apps is the ability to define exceptions to the policy and install an app even if it falls outside your defined policy | 07:04 |
| ajmitch | dpm: I think it could be something to keep in mind for future work | 07:04 |
| ajmitch | maybe in a couple of cycles for someone interested | 07:05 |
| dpm | ajmitch, definitely. I think it is not an essential feature to implement the first cut of the spec, but I agree that it might be something to be implemented by someone interested along the road. Remember to mention it in the feedback | 07:06 |
| ajmitch | will do, just about finished putting hard drives in new computer :) | 07:07 |
| dpm | coolbhavi, I modified the markup on your feedback to make the quoted sections more clear, I hope you don't mind. I'll go and answer your questions now | 07:07 |
| dpm | ajmitch, I hope everything works! :) | 07:07 |
| ajmitch | so do I! | 07:07 |
| dpm | :) | 07:08 |
| coolbhavi | dpm, by which I understand that we will have apps cpmply against a standard security policy control and apart from that you can add exceptions to a single app while installing | 07:08 |
| coolbhavi | dpm, ok no issues | 07:08 |
| dpm | coolbhavi, exactly | 07:08 |
| coolbhavi | dpm, thanks! | 07:08 |
| ajmitch | exceptions are not done by the user while installing, but chosen by the app author, anything custom gets a manual review | 07:09 |
| ajmitch | so you can choose that you need to have access to all of d-bus when uploading your app, but it'd get some scrutiny | 07:09 |
| dpm | ajmitch, that was a couple of revisions ago, we changed that in the spec, | 07:10 |
| ajmitch | dpm: I need to keep up then | 07:10 |
| dpm | ajmitch, in line with reducing manual review, we've disabled the ability to specify any custom permissions | 07:10 |
| ajmitch | ok | 07:10 |
| dpm | so app authors have to go with the permissions (to be exact AppArmor abstractions) we're presenting them | 07:11 |
| ajmitch | I'll give feedback on not liking presenting more options to the user in the software centre :) | 07:11 |
| dpm | anything outside that is a NACK, and the app cannot be uploaded | 07:11 |
| ajmitch | I know it's like what android does | 07:11 |
| dpm | in a way, but Android does not have the exception mechanism we're introducing | 07:12 |
| coolbhavi | ajmitch, :) | 07:12 |
| ajmitch | right, I also know that people often click whatever's in front of them | 07:12 |
| ajmitch | I'll re-read the spec before giving feedback later | 07:15 |
| coolbhavi | dholbach, hey good morning! | 07:19 |
| dholbach | good morning | 07:19 |
| dholbach | namaste coolbhavi | 07:19 |
| coolbhavi | namaste dholbach :) think you missed a interesting conversation here :) | 07:20 |
| coolbhavi | dpm, ^^^ :) | 07:20 |
| ajmitch | hi dholbach | 07:21 |
| dholbach | hi ajmitch :) | 07:21 |
| dholbach | which conversation was that? | 07:23 |
| coolbhavi | dholbach, regarding the app dev spec | 07:24 |
| dholbach | aha | 07:27 |
| dpm | sure, thanks ajmitch! | 07:28 |
| * coolbhavi goes to lunch | 07:29 | |
| dpm | coolbhavi, I've finished replying to your feedback, let me know if that all makes sense to you | 07:29 |
| dpm | morning dholbach! | 07:29 |
| * ajmitch refreshes again | 07:30 | |
| coolbhavi | dpm, sure :) me too if permitted will re read the spec again after my UDW session today and provide additional feedback/ask doubts | 07:30 |
| dpm | coolbhavi, excellent, thanks, that's very helpful | 07:31 |
| dpm | coolbhavi, let me add a mention to how review and rejection works to the spec, as per your input earlier on | 07:31 |
| coolbhavi | dpm, thanks a lot! cya around | 07:32 |
| PaoloRotolo | Hi all! | 08:55 |
| dpm | hey PaoloRotolo :) | 09:05 |
| ajmitch | hi PaoloRotolo | 09:07 |
| PaoloRotolo | Hey dpm, ajmitch :) | 09:08 |
| gotwig | please checkout my "application" https://myapps.developer.ubuntu.com/dev/apps/749/ | 12:09 |
| coolbhavi | gotwig, Thanks for your submission to the ARB. We will be checking it out and we will get in touch with you soon with our reviews | 13:01 |
| gotwig | coolbhavi: really nice, I waited 4 months ^^ | 13:02 |
| gotwig | coolbhavi: I have now ported it to python 3 | 13:02 |
| coolbhavi | gotwig, sorry to hear that you have waited for 4 months | 13:03 |
| gotwig | coolbhavi: the app is not that "well" maintained :-) I have to study much | 13:03 |
| coolbhavi | gotwig, thats nice hearing that you have ported to py3 we will have a look and get back to you shortly | 13:04 |
| * gotwig is back | 13:17 | |
| gotwig | I am sorry, some class mates played with the pc ;) | 13:18 |
| mhall119 | coolbhavi: ajmitch: just finished reading the whole conversation | 14:16 |
| mhall119 | to be clear, the *only* manual review in the spec will be identifying the developer | 14:16 |
| mhall119 | this will allow us to prevent anonymous uploading, so the chances of someone uploading malicious code will be greatly reduced | 14:17 |
| mhall119 | the sandbox is there to prevent accidental or poorly-thought-out code from doing bad things | 14:18 |
| mhall119 | and while we will remove apps from the archive if they violate the terms and conditions, we won't be removing them form people's machines | 14:18 |
| coolbhavi | mhall119, thanks a lot that was my concern meant by manual review in developer identification/verification | 14:18 |
| mhall119 | coolbhavi: right, so they will have to state that they are allowed by the project to upload, but we won't have to verify that | 14:19 |
| mhall119 | we'll only verify that if someone else from the project objects | 14:19 |
| coolbhavi | seems fine with me | 14:20 |
| mhall119 | ajmitch: we had discussed giving the user the ability to select which apparmor policies to allow and which to deny, but the concern is that would put a considerable amount of extra work on the developer to be able to handle any combination of accepted/rejected access | 14:21 |
| mhall119 | for example,I couldn't just assume in my code that I could send desktop notifications, I'd have to try/catch everything and gracefully handle failures | 14:22 |
| mhall119 | ajmitch: I'm checking in on that RT, if you guys ever have any problems with things like that just let me know and I'll hound somebody about it | 14:31 |
| coolbhavi | mhall119, thanks for your wonderful work on the spec btw :) | 14:43 |
| mhall119 | :) | 14:48 |
| mhall119 | thanks for taking the time to read it (I know it's long) and give feedback | 14:49 |
| coolbhavi | mhall119, you are welcome hopefully I can addon re-reading the spec after my UDW session :) | 14:50 |
| coolbhavi | mhall119, shall I pm you? | 14:50 |
| mhall119 | coolbhavi: sure | 14:51 |
| mhall119 | but if it's about the spec, it'd be better to discuss it here | 14:51 |
| coolbhavi | mhall119, not about the spec though :) | 14:52 |
| gotwig | jo | 15:00 |
| PaoloRotolo | Hello! | 15:54 |
| coolbhavi | hello PaoloRotolo | 15:55 |
| PaoloRotolo | Hey, coolbhavi :) | 15:55 |
| coolbhavi | :) | 15:55 |
| PaoloRotolo | coolbhavi: you've a session at 16:00, right :)? | 15:57 |
| coolbhavi | yep | 15:57 |
| coolbhavi | :) | 15:57 |
| PaoloRotolo | cool | 15:57 |
| gotwig | coolbhavi: whats the topic? | 15:58 |
| coolbhavi | gotwig, regarding dev advisory team | 15:59 |
| gotwig | okay | 15:59 |
| gotwig | coolbhavi: are you also part of the arb? | 15:59 |
| coolbhavi | yes | 15:59 |
| gotwig | nice that I final catch one guy ;P | 15:59 |
| PaoloRotolo | Hi gotwig :) | 16:00 |
| gotwig | coolbhavi: so can you maybe tell me when my app gets reviewed, or I get more info? I think I need more Info for packaging properly. its a bit hacky, mhall helped me | 16:00 |
| gotwig | PaoloRotolo: sup ;) | 16:00 |
| coolbhavi | gotwig, ll get back to you after my session | 16:01 |
| gotwig | coolbhavi: when is your session? in hours please | 16:01 |
| gotwig | I am in another timezone ;) | 16:01 |
| PaoloRotolo | gotwig: now :P | 16:01 |
| gotwig | PaoloRotolo: :-) | 16:01 |
| PaoloRotolo | gotwig: what is your app? | 16:02 |
| gotwig | PaoloRotolo: Unity Cooking Lens | 16:03 |
| gotwig | https://myapps.developer.ubuntu.com/dev/apps/749/ | 16:03 |
| PaoloRotolo | gotwig: great. I'll try it too | 16:03 |
| gotwig | PaoloRotolo: you should read the AskUbuntu post :-) | 16:04 |
| gotwig | http://askubuntu.com/a/105184 | 16:05 |
| gotwig | PaoloRotolo: do you know about cookety? | 16:08 |
| gotwig | coolbhavi: where is your session? | 16:11 |
| PaoloRotolo | gotwig: now, sorry | 16:12 |
| PaoloRotolo | now/no | 16:13 |
| gotwig | PaoloRotolo: you sould check it out. I think about supporting it. It seems it author has gave it a shot | 16:15 |
| coolbhavi | dpm, got a ARB question :) | 16:50 |
| gotwig | Hey there.. | 18:13 |
| mhall119 | ajmitch: can you ping deej in #canonical-sysadmin about that RT? | 18:29 |
| mhall119 | he's trying to find out what's going on | 18:29 |
| gotwig | cielak: hey | 19:04 |
| cielak | hey gotwig | 19:05 |
| gotwig | cielak: are you a arb guy ;P ? | 19:06 |
| cielak | gotwig: sorry, no | 19:06 |
| ajmitch | mhall119: sure, that's why I thought I'd ping you about it, in case you knew someone who could get it moving | 19:31 |
| mhall119 | thanks ajmitch | 19:41 |
| ajmitch | np, about the only thing I can do this week :) | 19:41 |
Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!